{"id":"CVE-2026-96809","published":"2026-10-09T10:16:45.980","lastModified":"2026-10-11T12:17:30.817","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/eduadmin-booking/vulnerability/wordpress-eduadmin-booking-plugin-6-0-0-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This SQL injection vulnerability in EduAdmin Booking allows attackers to perform blind SQL injection attacks without authentication, potentially leading to full database access and data exposure. The flaw occurs when user input is not properly sanitized before being used in SQL queries.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be performed through blind SQL injection techniques, though it may require multiple requests to extract data.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive educational data including student records, booking information, and potentially other database contents, affecting the entire institution's data integrity.","remediation":"Upgrade to version 6.0.0 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","database"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:51:59.474Z"}}